Clik here to view.
$1120: ATO Bug in Twitter’s
Explore the story of a $1120 Twitter bug, I found — a security flaw that allowed attackers to seize full control of accounts without knowing the password. Everyone who is reading this,I think aware of...
View ArticleHow I found a Zero Day in W3 Schools
While using the W3Schools.com C Compiler I decided to play around with the shell. Link to the compiler : https://www.w3schools.com/c/tryc.php?filename=demo_compiler #include #include int main() {...
View ArticleClik here to view.
Hack the Web like a Pirate: Identifying Vulnerabilities with Style
24 Stories A Hacker’s Tale Ahoy, fellow digital adventurers! Today, we’re embarking on an exciting journey through the vast seas of web applications. Our quest? To uncover hidden treasures, or in this...
View ArticleClik here to view.
Navigating the Bounty Seas with Open Bug Bounty
A Hacker’s Tale – Part 2 Welcome back, cyber adventurers, to our world of ethical hacking! In Part One, we set sail on the vast ocean of cybersecurity, armed with knowledge on identifying features,...
View ArticleClik here to view.
Guarding the Cosmos: Securing Your WordPress {wp-config.php}
Prepare for liftoff, fellow space explorers of the digital galaxy! In the boundless expanse of cyberspace, your WordPress website is akin to a spacecraft on an interstellar voyage. At the core of this...
View ArticleClik here to view.
Top Bug Bounty Courses and Certifications
Here are some of the top bug bounty courses and certifications available: Bug Bounty Hunter (CBH) through HackTheBox Academy Link Bug Bounty Hunter (CBH) through HackTheBox Academy A comprehensive...
View ArticleEducation and Training in Bug Bounty
Education and training are essential for aspiring bug bounty hunters to develop the skills and knowledge necessary to identify and exploit vulnerabilities in computer systems, applications, and...
View ArticlePublic and Private Bug Bounties and Vulnerability Disclosure Programs
Public and private bug bounties and vulnerability disclosure programs (VDPs) are both mechanisms for organizations to discover and fix vulnerabilities in their software systems. Public Bug Bounties...
View ArticleDifference Between Penetration Testing and Bug Bounty
Penetration Testing and Bug Bounty are both methods of identifying and exploiting vulnerabilities in computer systems, applications, or networks. However, there are some key differences between the...
View ArticleTop Bug Bounty Tools
Bug bounty hunters rely on a variety of tools to effectively identify and exploit vulnerabilities in computer systems, applications, and networks. These tools help streamline the process, enhance...
View ArticleLearn Command Injection Vulnerabilities
Comman Injection Command Injection and OS command Injection also known as shell injection is a web security vulnerability in which an attacker can run arbitrary commands in a server Operating System....
View ArticleClik here to view.
An Authentication Bypass Vulnerabilities Methodologies
Overview Authentication Bypass Vulnerabilities are common flaws in web applications today, but they are not always easy to find.With the continuous development of technology and the integration of...
View ArticleClik here to view.
Finding with dork a multiple DOM XSS in the same html
A month ago I tried to search a programs in bug bounty and I saw a domain web.com and I try ever with a simple dork: site:web.com ext:html. Tried to search a different extension the most vulnerable is...
View ArticleClik here to view.
XSS vulnerabilities discovered in ServiceNow – CVE-2022-38463
Hey everyone, This is a blog related to my recent CVE on ServiceNow.It was found while testing a bug bounty program that was using ServiceNow and their in-scope domain was ‘redacted.service-now.com’....
View ArticleClik here to view.
Turning cookie-based XSS into account takeover
The cookie-based XSS One evening I started hunting on the Terrahost Bug Bounty program. I was testing the terrahost.no main domain. There was a functionality where I could choose the service, then...
View ArticleCVE 2022-29455 is still affecting millions of WordPress sites
– The DOM-based Reflected Cross-Site Scripting (XSS) vulnerability is in Elementor’s Elementor Website Builder plugin <= 3.5.5 versions. This issue leads to: CVE 2022-29455 4websecurity.com...
View ArticleZabbix – SAML SSO Authentication Bypass
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified....
View ArticleClik here to view.
The Time Machine — Weaponizing WaybackUrls for Recon, BugBounties , OSINT,...
You must have heard about time travel in movies, series and comics. Well here we are Nah i’m not joking you can travel back in time and can fetch the endpoints from web applications to do further...
View ArticleUltimate XSS Polyglot
jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e
View ArticleThe Most used Chrome Extensions are Used For Penetration Testing.
Mostly, penetration testing can use the extensions for the purpose to locate the broken links and inform the client, and these extensions also help to determine whether a target website contains...
View Article
![[QLD, NSW, VIC] Samsung 65](http://files.ozbargain.com.au/n/31/978831l.jpg?h=8d64f0c6)
